Diagnosing Facebook Graph API Posting Failures Due to Expired or Misconfigured Page Access Tokens

Recognizable Condition

Scheduled or API‑driven attempts to publish to a Facebook Page return errors such as OAuth error 190 (subcode 463) or (#200) Permissions error, while the same content can be posted manually through Page Manager or the Facebook UI. The failure is intermittent or persistent, and the error response does not change after retrying the request.

Cause / Diagnostic Table

Possible Cause	Typical Indicator in Error	What to Verify
Expired long‑lived Page token	OAuth 190, subcode 463	Token debug shows expires_at in the past
Missing required scope (pages_manage_posts or pages_read_engagement)	(#200) Permissions error	Token debug scopes list does not contain the needed permission
User no longer has Admin/Editor role on the Page	OAuth 190, subcode 460 or 463	/me/accounts does not list the Page or shows a lower role
App is in Development mode restricting access to test users	OAuth 190, subcode 460	App settings > Basic > App Mode shows Development and the acting user is not a tester/admin
App secret mismatch during token exchange	OAuth 190, subcode 464 (invalid_appsecret)	Token debug app_id does not match the app used for exchange, or exchange fails

Ordered Checks

1. Capture the full error from the Graph API response (error.code, error.subcode, error.message). Note the timestamp and the Page ID involved.
2. Debug the token in use by calling the debug endpoint:

   GET https://graph.facebook.com/debug_token?input_token={PAGE_ACCESS_TOKEN}&access_token={APP_ID}|{APP_SECRET}

   This request must be made from a server where you can protect the APP_SECRET. Required permission: none beyond having a valid app token (APP_ID|APP_SECRET). Expected output includes data.app_id, data.user_id, data.expires_at (Unix timestamp), and data.scopes array. Risk: exposing the app secret in logs or client‑side code.
3. Validate expiration: compare expires_at to the current time. If it is in the past, the token has expired.
4. Check scopes: ensure the scopes array contains pages_manage_posts (required for publishing) and optionally pages_read_engagement for reading insights.
5. Confirm token‑to‑Page mapping:

   GET https://graph.facebook.com/me/accounts?access_token={PAGE_ACCESS_TOKEN}

   Look for an entry where id matches your Page ID and verify that the access_token field corresponds to the token you are using.
6. Verify user role: using a user token (or the same Page token) call

   GET https://graph.facebook.com/{PAGE_ID}?fields=access_token&access_token={USER_OR_PAGE_TOKEN}

   Then inspect the role via the Page settings or via

   GET https://graph.facebook.com/{PAGE_ID}/roles?access_token={USER_TOKEN}

   Ensure the user associated with the token holds Admin or Editor.
7. Check app mode: in the Facebook Developer dashboard, navigate to Settings → Basic. If App Mode is Development, only users listed under Roles → Testers (or admins) can obtain valid Page tokens.

Fixes Tied to Findings

• Token expired: Obtain a fresh short‑lived user token (via login flow), exchange it for a 60‑day long‑lived user token:

  GET https://graph.facebook.com/oauth/access_token?grant_type=fb_exchange_token&client_id={APP_ID}&client_secret={APP_SECRET}&fb_exchange_token={SHORT_LIVED_USER_TOKEN}

  Then derive a new Page token:

  GET https://graph.facebook.com/me/accounts?access_token={NEW_LONG_LIVED_USER_TOKEN}

  Use the returned Page access token for publishing.
• Missing scope: Re‑initiate the OAuth login flow requesting pages_manage_posts (and pages_read_engagement if needed). After the user authorizes, repeat the token exchange steps above to get a new Page token with the correct scopes.
• Role lost: Have an existing Admin assign the user back to Admin or Editor role in the Page Settings → Page Roles. After the role change, generate a new Page token as described in the expired‑token fix.
• App in Development mode: Switch the app to Live mode (App Review → Status & Review) or add the affected user as a tester in the Developer dashboard under Roles → Testers. Then regenerate the token.
• App secret mismatch: Verify that the APP_SECRET used in token exchange matches the secret shown in the Developer dashboard. If the secret was rotated, update all stored secrets and repeat the token exchange.

Escalation Criteria

If after performing the checks and applying the corresponding fix the API still returns error 190 (any subcode) or (#200) Permissions error, collect the following information for escalation to Facebook Support or for a deeper review:

• App ID
• Page ID
• Exact error JSON (code, subcode, message)
• Output of the token debug endpoint (app_id, user_id, expires_at, scopes)
• Timestamps of the failing requests and of the token debug call
• Confirmation that the user is still an Admin/Editor on the Page

Repeated token invalidation within a few hours, despite a valid debug response, may indicate that the app has been flagged or that a permission is pending review; in such cases, submit the collected data through the Facebook Bug Report or Support channels.

Verification

After applying a fix, confirm success with a minimal write test:

POST https://graph.facebook.com/{PAGE_ID}/feed
  access_token={FIXED_PAGE_ACCESS_TOKEN}
  message=Test+post+from+diagnostic+script

A successful response returns a JSON object containing id (the newly created post ID). If this request succeeds, the underlying token issue is resolved. Additionally, re‑run the debug endpoint to ensure expires_at is in the future and that the required scopes are present.